Dasharo · miczyg1 · Jul 1, 2026 · Jul 1, 2026 · Jul 1, 2026 · Jul 1, 2026
diff --git a/configs/config.msi_ms7d25_ddr4 b/configs/config.msi_ms7d25_ddr4
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v1.1.7-rc2"
+CONFIG_LOCALVERSION="v1.1.7-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,10 +36,14 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="0f3e8ba6-19d3-461b-bbbc-8b5689fe8097"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010702
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010703
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01010701
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y

diff --git a/configs/config.msi_ms7d25_ddr5 b/configs/config.msi_ms7d25_ddr5
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v1.1.7-rc2"
+CONFIG_LOCALVERSION="v1.1.7-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,10 +36,14 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="119059ec-1a5e-4844-b2e6-6f573b257570"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010702
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01010703
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01010701
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y

diff --git a/configs/config.msi_ms7e06_ddr4 b/configs/config.msi_ms7e06_ddr4
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v0.9.5-rc2"
+CONFIG_LOCALVERSION="v0.9.5-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,10 +36,14 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="91e6522e-25e1-4543-9b38-02e2aeafc9ed"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090502
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090503
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x00090501
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y

diff --git a/configs/config.msi_ms7e06_ddr5 b/configs/config.msi_ms7e06_ddr5
@@ -1,4 +1,4 @@
-CONFIG_LOCALVERSION="v0.9.5-rc2"
+CONFIG_LOCALVERSION="v0.9.5-rc3"
 CONFIG_OPTION_BACKEND_NONE=y
 CONFIG_SBOM=y
 CONFIG_SBOM_PAYLOAD=y
@@ -36,10 +36,14 @@ CONFIG_PCIEXP_LANE_ERR_STAT_CLEAR=y
 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
 CONFIG_DRIVERS_EFI_FW_INFO=y
 CONFIG_DRIVERS_EFI_MAIN_FW_GUID="58301b3d-5b6d-4562-9ec1-fbce40f15253"
-CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090502
+CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x00090503
 CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x00090501
 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y
 CONFIG_TPM2=y
+CONFIG_STM=y
+CONFIG_STM_STMPE_ENABLED=y
+CONFIG_STM_TTYS0_BASE=0x0f0
+CONFIG_STM_CBMEM_CONSOLE=y
 CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
 CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y

diff --git a/payloads/external/Makefile.mk b/payloads/external/Makefile.mk
@@ -213,14 +213,10 @@ $(obj)/UEFIPAYLOAD.fd: $(DOTCONFIG) $(IPXE_EFI)
 		CONFIG_SOC_AMD_COMMON_BLOCK_PSP_GEN2=$(CONFIG_SOC_AMD_COMMON_BLOCK_PSP_GEN2) \
 		CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=$(CONFIG_DRIVERS_EFI_UPDATE_CAPSULES) \
 		CONFIG_DRIVERS_EFI_MAIN_FW_GUID=$(CONFIG_DRIVERS_EFI_MAIN_FW_GUID) \
-		GCC_CC_x86_32=$(GCC_CC_x86_32) \
-		GCC_CC_x86_64=$(GCC_CC_x86_64) \
-		GCC_CC_arm=$(GCC_CC_arm) \
-		GCC_CC_arm64=$(GCC_CC_arm64) \
-		OBJCOPY_x86_32=$(OBJCOPY_x86_32) \
-		OBJCOPY_x86_64=$(OBJCOPY_x86_64) \
-		OBJCOPY_arm=$(OBJCOPY_arm) \
-		OBJCOPY_arm64=$(OBJCOPY_arm64) \
+		GCC_IA32_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_32)) \
+		GCC_X64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_64)) \
+		GCC_ARM_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm)) \
+		GCC_AARCH64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm64)) \
 		MFLAGS= MAKEFLAGS= \
 		CONFIG_EDK2_ABOVE_4G_MEMORY=$(CONFIG_EDK2_ABOVE_4G_MEMORY) \
 		CONFIG_EDK2_BATTERY_CONFIG_OPTION=$(CONFIG_EDK2_BATTERY_CONFIG_OPTION) \
@@ -308,7 +304,8 @@ $(obj)/UEFIPAYLOAD.fd: $(DOTCONFIG) $(IPXE_EFI)
 		CONFIG_EDK2_VGA_BIOS_VENDOR_ID=0x$(word 1,$(subst $(comma),$(spc),$(call strip_quotes,$(CONFIG_VGA_BIOS_ID)))) \
 		CONFIG_EDK2_VGA_BIOS_DEVICE_ID=0x$(word 2,$(subst $(comma),$(spc),$(call strip_quotes,$(CONFIG_VGA_BIOS_ID)))) \
 		CONFIG_VGA_BIOS_FILE=$(CONFIG_VGA_BIOS_FILE) \
-		CONFIG_BOOTSPLASH_REGION_LOGO_FILE=$(CONFIG_BOOTSPLASH_REGION_LOGO_FILE)
+		CONFIG_BOOTSPLASH_REGION_LOGO_FILE=$(CONFIG_BOOTSPLASH_REGION_LOGO_FILE) \
+		CONFIG_STM=$(CONFIG_STM)
 
 $(obj)/ShimmedUniversalPayload.elf: $(DOTCONFIG)
 	$(MAKE) -C payloads/external/edk2 UniversalPayload \
@@ -341,14 +338,10 @@ $(obj)/ShimmedUniversalPayload.elf: $(DOTCONFIG)
 		CONFIG_ECAM_MMCONF_LENGTH=$(CONFIG_ECAM_MMCONF_LENGTH) \
 		CONFIG_CPU_XTAL_HZ=$(CONFIG_CPU_XTAL_HZ) \
 		CONFIG_SMMSTORE_V2=$(CONFIG_SMMSTORE_V2) \
-		GCC_CC_x86_32=$(GCC_CC_x86_32) \
-		GCC_CC_x86_64=$(GCC_CC_x86_64) \
-		GCC_CC_arm=$(GCC_CC_arm) \
-		GCC_CC_arm64=$(GCC_CC_arm64) \
-		OBJCOPY_x86_32=$(OBJCOPY_x86_32) \
-		OBJCOPY_x86_64=$(OBJCOPY_x86_64) \
-		OBJCOPY_arm=$(OBJCOPY_arm) \
-		OBJCOPY_arm64=$(OBJCOPY_arm64) \
+		GCC_IA32_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_32)) \
+		GCC_X64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_x86_64)) \
+		GCC_ARM_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm)) \
+		GCC_AARCH64_PREFIX=$(patsubst %gcc,%,$(GCC_CC_arm64)) \
 		MFLAGS= MAKEFLAGS=
 
 # FILO

diff --git a/payloads/external/edk2/Kconfig.dasharo b/payloads/external/edk2/Kconfig.dasharo
@@ -4,7 +4,7 @@ config EDK2_REPOSITORY
 	default "https://github.com/Dasharo/edk2"
 
 config EDK2_TAG_OR_REV
-	default "61ce35c29bb384240028d4319755b5759affbbe1"
+	default "6d5a8a9a6363e2b30657c4ee4d2088ec11356f0b"
 
 config EDK2_SYSTEM76_EC_LOGGING
 	bool "Enable edk2 logging to System76 EC"

diff --git a/payloads/external/edk2/Makefile b/payloads/external/edk2/Makefile
@@ -25,7 +25,15 @@ else
 export PACKAGES_PATH := $(EDK2_PATH)
 endif
 
-OBJCOPY = $(GCC_PREFIX)objcopy
+OBJCOPY = $(GCC_IA32_PREFIX)objcopy
+
+export GCC_IA32_PREFIX
+export GCC_X64_PREFIX
+export GCC_ARM_PREFIX
+export GCC_AARCH64_PREFIX
+# tools_def.txt maps GCC_IA32_PREFIX and GCC_X64_PREFIX both to ENV(GCC_BIN).
+# Use the X64 prefix as GCC_BIN since x86_64-elf-gcc handles IA32 (-m32) too.
+export GCC_BIN := $(GCC_X64_PREFIX)
 
 PAYLOAD_NAME=DasharoPayloadPkg
 
@@ -460,6 +468,10 @@ BUILD_STR += -D USE_AMD_PLATFORM_GOP=TRUE
 BUILD_STR += --pcd gDasharoPayloadPkgTokenSpaceGuid.AmdVbiosOptionRomVendorId=$(CONFIG_EDK2_VGA_BIOS_VENDOR_ID)
 BUILD_STR += --pcd gDasharoPayloadPkgTokenSpaceGuid.AmdVbiosOptionRomDeviceId=$(CONFIG_EDK2_VGA_BIOS_DEVICE_ID)
 endif
+# PcdShowSecurityStmOption = FALSE
+ifeq ($(CONFIG_STM),y)
+BUILD_STR += --pcd gDasharoSystemFeaturesTokenSpaceGuid.PcdShowSecurityStmOption=TRUE
+endif
 
 BUILD_STR += --pcd gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVersionString=$(CONFIG_EDK2_FW_VERSION)
 BUILD_STR += --pcd gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVendor=$(CONFIG_EDK2_FW_VENDOR)

diff --git a/src/cpu/x86/smm/smm_module_handler.c b/src/cpu/x86/smm/smm_module_handler.c
@@ -130,6 +130,25 @@ bool smm_region_overlaps_handler(const struct region *r)
 	return region_overlap(&r_smm, r) || region_overlap(&r_aseg, r);
 }
 
+void smm_stm_restore_smram_to_vmcs(void *smm_save_state)
+{
+	if (!CONFIG(STM))
+		return;
+
+	/*
+	 * Signal STM to propagate SMRAM save state changes back to the
+	 * interrupted guest VMCS on RSM. Required for return values written to
+	 * EAX (e.g. SMMSTORE result) to be visible in OS context after RSM.
+	 * Without this bit set, ReadSyncSmmStateSaveArea() in the STM runtime
+	 * skips the sync entirely, so the guest sees stale pre-SMI register
+	 * values instead of the handler's return code.
+	 */
+	TXT_PROCESSOR_SMM_DESCRIPTOR *psd =
+		(TXT_PROCESSOR_SMM_DESCRIPTOR *)
+		((uintptr_t)smm_save_state - STM_PSD_SIZE);
+	psd->smm_resume_state.smram_to_vmcs_restore_required = 1;
+}
+
 asmlinkage void smm_handler_start(void *arg)
 {
 	const struct smm_module_params *p;

diff --git a/src/cpu/x86/smm/smm_module_loader.c b/src/cpu/x86/smm/smm_module_loader.c
@@ -358,7 +358,13 @@ static void setup_smihandler_params(struct smm_runtime *mod_params,
 			return;
 		}
 
-		void *ptr = cbmem_add(CBMEM_ID_SMM_COMBUFFER, info.block_size);
+		/*
+		 * Add additional 4KiB for parameters, so that arguments can be in the same
+		 * communication buffer, instead of arbitrary memory allocated by the caller.
+		 * It helps with STM resource reporting and keeping the SMI handlers from
+		 * accessing memory it doesn't have to access.
+		 */
+		void *ptr = cbmem_add(CBMEM_ID_SMM_COMBUFFER, info.block_size + 4 * KiB);
 		if (!ptr) {
 			printk(BIOS_ERR, "SMMSTORE: Failed to add com buffer\n");
 			return;

diff --git a/src/drivers/intel/fsp2_0/include/fsp/api.h b/src/drivers/intel/fsp2_0/include/fsp/api.h
@@ -6,6 +6,7 @@
 #include <stddef.h>
 #include <stdint.h>
 #include <fsp/soc_binding.h>
+#include <fsp/fsp_status_x64_to_x86.h>
 #include <soc/intel/common/mma.h>
 
 #define FSP_SUCCESS	EFI_SUCCESS

diff --git a/src/drivers/intel/fsp2_0/include/fsp/fsp_status_x64_to_x86.h b/src/drivers/intel/fsp2_0/include/fsp/fsp_status_x64_to_x86.h
@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef _FSP2_0_STATUS_X64_TO_X86_H_
+#define _FSP2_0_STATUS_X64_TO_X86_H_
+
+/* Fixup definitions for x86_64 mode when FSP uses 32bit mode */
+#if CONFIG(PLATFORM_USES_FSP2_X86_32) && CONFIG(USE_X86_64_SUPPORT)
+
+#undef MAX_BIT
+#undef ENCODE_RESET_REQUEST
+#undef FSP_STATUS_RESET_REQUIRED_COLD
+#undef FSP_STATUS_RESET_REQUIRED_WARM
+#undef FSP_STATUS_RESET_REQUIRED_3
+#undef FSP_STATUS_RESET_REQUIRED_4
+#undef FSP_STATUS_RESET_REQUIRED_5
+#undef FSP_STATUS_RESET_REQUIRED_6
+#undef FSP_STATUS_RESET_REQUIRED_7
+#undef FSP_STATUS_RESET_REQUIRED_8
+#undef FSP_STATUS_VARIABLE_REQUEST
+
+#undef EFI_SUCCESS
+#undef EFI_INVALID_PARAMETER
+#undef EFI_UNSUPPORTED
+#undef EFI_DEVICE_ERROR
+#undef EFI_NOT_FOUND
+#undef EFI_NOT_STARTED
+
+#define MAX_BIT				0x80000000
+#define ENCODE_RESET_REQUEST(ResetType)	\
+		((UINT32)((MAX_BIT >> 1) | (ResetType)))
+#define FSP_STATUS_RESET_REQUIRED_COLD	ENCODE_RESET_REQUEST(1)
+#define FSP_STATUS_RESET_REQUIRED_WARM	ENCODE_RESET_REQUEST(2)
+#define FSP_STATUS_RESET_REQUIRED_3	ENCODE_RESET_REQUEST(3)
+#define FSP_STATUS_RESET_REQUIRED_4	ENCODE_RESET_REQUEST(4)
+#define FSP_STATUS_RESET_REQUIRED_5	ENCODE_RESET_REQUEST(5)
+#define FSP_STATUS_RESET_REQUIRED_6	ENCODE_RESET_REQUEST(6)
+#define FSP_STATUS_RESET_REQUIRED_7	ENCODE_RESET_REQUEST(7)
+#define FSP_STATUS_RESET_REQUIRED_8	ENCODE_RESET_REQUEST(8)
+#define FSP_STATUS_VARIABLE_REQUEST	ENCODE_RESET_REQUEST(10)
+
+#define ENCODE_EFI_STATUS(Status)	\
+		((UINT32)((MAX_BIT) | (Status)))
+
+#define EFI_SUCCESS			0
+#define EFI_INVALID_PARAMETER		ENCODE_EFI_STATUS(2)
+#define EFI_UNSUPPORTED			ENCODE_EFI_STATUS(3)
+#define EFI_DEVICE_ERROR		ENCODE_EFI_STATUS(7)
+#define EFI_NOT_FOUND			ENCODE_EFI_STATUS(14)
+#define EFI_NOT_STARTED			ENCODE_EFI_STATUS(19)
+
+#endif
+
+#endif  /* _FSP2_0_STATUS_X64_TO_X86_H_ */
diff --git a/src/drivers/smmstore/store.c b/src/drivers/smmstore/store.c
@@ -419,7 +419,7 @@ static void *mmap_com_buf(struct region_device *com_buf, uint32_t offset, uint32
 
 	void *ptr = rdev_mmap(com_buf, offset, bufsize);
 	if (!ptr)
-		printk(BIOS_ERR, "smm store: not enough space for new data\n");
+		printk(BIOS_ERR, "smm store: could not mmap com buffer\n");
 
 	return ptr;
 }
@@ -478,7 +478,7 @@ int smmstore_rawwrite_region(uint32_t block_id, uint32_t offset, uint32_t bufsiz
 		return -1;
 
 	if (rdev_chain(&store, &store, block_id * SMM_BLOCK_SIZE + offset, bufsize)) {
-		printk(BIOS_ERR, "smm store: not enough space for new data\n");
+		printk(BIOS_ERR, "smm store: could not create subregion rdev\n");
 		return -1;
 	}
 

diff --git a/src/include/cpu/x86/smm.h b/src/include/cpu/x86/smm.h
@@ -141,6 +141,12 @@ void *smm_get_save_state(int cpu);
 /* Returns true if the region overlaps with the SMM */
 bool smm_region_overlaps_handler(const struct region *r);
 
+/*
+ * Sets the bit to restore modified SMRAM to VMCS when STM is enabled.
+ * Requird to be called by all SMI handler that modify save state.
+ */
+void smm_stm_restore_smram_to_vmcs(void *smm_save_state);
+
 /* Returns true if the memory pointed to overlaps with SMM reserved memory. */
 static inline bool smm_points_to_smram(const void *ptr, const size_t len)
 {

diff --git a/src/mainboard/msi/ms7d25/Kconfig b/src/mainboard/msi/ms7d25/Kconfig
@@ -95,4 +95,20 @@ config INTEL_FIT_LOC
 
 endif
 
+if STM
+
+config IED_REGION_SIZE
+	default 0x0
+
+config SMM_TSEG_SIZE
+	default 0x1000000
+
+config MSEG_SIZE
+	default 0xCD0000
+
+config STM_HEAPSIZE
+	default 0xB47000
+
+endif
+
 endif
diff --git a/src/mainboard/msi/ms7d25/Makefile.mk b/src/mainboard/msi/ms7d25/Makefile.mk
@@ -8,6 +8,7 @@ romstage-y += romstage_fsp_params.c
 
 ramstage-y += mainboard.c
 ramstage-y += smbios.c
+ramstage-$(CONFIG_STM) += stm.c
 
 all-y += die.c
 smm-y += die.c

diff --git a/src/mainboard/msi/ms7d25/stm.c b/src/mainboard/msi/ms7d25/stm.c
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <security/intel/stm/SmmStm.h>
+#include <security/intel/stm/StmPlatformResource.h>
+
+// Nuvoton SIO resources
+static STM_RSC_IO_DESC rsc_sio_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     0x4e, 2};
+
+static STM_RSC_IO_DESC rsc_hwm_io = {{IO_RANGE, sizeof(STM_RSC_IO_DESC)},
+				     0xa20, 8};
+
+int mainboard_stm_add_resources(void)
+{
+	int Status = 0;
+
+	Status |= add_pi_resource((void *)&rsc_sio_io, 1);
+	Status |= add_pi_resource((void *)&rsc_hwm_io, 1);
+
+	return Status;
+}
diff --git a/src/mainboard/msi/ms7e06/Kconfig b/src/mainboard/msi/ms7e06/Kconfig
@@ -94,5 +94,20 @@ config INTEL_FIT_LOC
 
 endif
 
+if STM
+
+config IED_REGION_SIZE
+	default 0x0
+
+config SMM_TSEG_SIZE
+	default 0x1000000
+
+config MSEG_SIZE
+	default 0xCD0000
+
+config STM_HEAPSIZE
+	default 0xB47000
+
+endif
 
 endif
diff --git a/src/mainboard/msi/ms7e06/Makefile.mk b/src/mainboard/msi/ms7e06/Makefile.mk
@@ -9,6 +9,7 @@ romstage-y += romstage_fsp_params.c
 
 ramstage-y += mainboard.c
 ramstage-y += smbios.c
+ramstage-$(CONFIG_STM) += stm.c
 
 all-y += die.c
 smm-y += die.c